AI agents in finance grew faster than anyone expected. The audit trail didn't.

Agents in production before the rules caught up

Financial institutions have been deploying AI agents faster than most people expected. ^[1] The technology works, the business case is clear and the competitive pressure is real. What lagged behind is the infrastructure for proving what those agents did.

An agent that books a trade, changes an order or answers a compliance question generates a record, often in a log. If the agent makes a mistake, or if someone questions what it did, the log is where you look. The trouble is that logs are kept by the same organisation that runs the agent. In a dispute, or during an audit, that's easy to challenge.

The rules now catching up with deployment don't leave much room. DORA, which has applied across European financial services since 17 January 2025, requires log systems to be protected against tampering, deletion and unauthorised access. ^[2] The AI Act, which starts applying to high-risk systems from December 2027 for Annex III cases and August 2028 for Annex I, says those systems must technically allow automatic logging over their lifetime and that logs must be kept for at least six months. ^[3][4]

That combination creates a gap. Most organisations have logging. Fewer have a way of showing that the log they produce six months later is the one written at the time.

What an agent's log needs to show

An AI agent in finance might execute trades, adjust portfolios, screen transactions for sanctions, respond to customer queries or run compliance checks. ^[1] Each of those actions generates a record: the instruction, the tool the agent called, the result and, if there was human oversight, who reviewed it.

If a customer disputes a transaction, if a regulator asks what the agent did during a market event, or if an auditor questions whether the logs were altered, the burden is on the organisation to show what actually happened. A log file on a server the organisation controls is a starting point, but it isn't proof. Anyone with administrator access could edit it, and in a dispute that possibility is often enough to keep the argument going.

DORA's delegated regulation is specific: log systems must protect against tampering and detect logging failures. ^[2] The AI Act adds that high-risk systems must log events automatically and that both the provider and the user must keep those logs for at least six months, unless another law requires more. ^[3][4] Neither regulation says how to protect the logs, but both assume you can.

The audit question is simple. Could you show that the log you are presenting is the one written when the agent acted, unchanged since?

How a digital witness closes the gap

Here, the thing to seal is each action record as it is written: the instruction the agent received, the tool it called, the result it got back and, if it applies, the reviewer. WitniumChain takes a fingerprint of that record, not the record itself, so the action log never leaves your systems. The fingerprint is sealed on a chain where any later change would show, even one made by the organisation running the witness.

When an auditor, a supervisor or a customer questions what the agent did, you calculate the fingerprint again. If it matches, the record is exactly what was written at the time. Change a single character in the log and it won't match.

Who can check? Anyone you share the record with: internal audit, external auditors, the regulator or the customer. They don't have to trust you, because the check is independent. That's the point.

What it doesn't do: it doesn't show that the agent's decision was correct, fair or lawful, or that the log is complete. It shows that the record you are presenting hasn't changed since it was sealed.

You can seal each action as it happens, or seal log segments every few minutes. The choice depends on how often actions occur and how granular the audit trail needs to be. Either way, the content stays with you and the fingerprint goes to the witness.

How it would work

1. Agent acts, log record is written.
2. Your system sends a fingerprint of that record to WitniumChain and gets a witness ID back.
3. Later, anyone you share the log with can recalculate the fingerprint and check it against the sealed one.

You integrate through the REST API, the SDK or the MCP server. ^[6] The first 2,000 witnesses a month are free.

What this means for you

If you run AI agents in a financial institution, ask these questions now:

• Could we show what our agents did on a given day, in a way that holds up under scrutiny?
• Who keeps the logs, and could someone with administrator access edit them without it showing?
• Do we have a way of proving to an auditor or a regulator that a log hasn't changed since it was written?
• When does the AI Act's logging requirement apply to our systems: December 2027, August 2028 or not at all?

DORA already applies. The AI Act's high-risk logging rules are months away for some systems. The infrastructure question is the same for both: can you show that your logs are trustworthy?

A digital witness doesn't replace logging, access control or monitoring. It gives you a way of showing that a log is unchanged, which is what the regulations assume you can do and what audits increasingly ask for.

If the agent made a decision that affects a customer, a trade or a compliance check, the question will come. Answering it is easier when you sealed the record at the time.

What to watch

• 2 December 2027: AI Act high-risk requirements for Annex III systems, including automatic logging under Article 12. ^[3]
• 2 August 2028: AI Act high-risk requirements for Annex I systems, including the same logging duty. ^[3]
• National implementation of DORA's technical standards on ICT risk, which already require log protection. ^[2]